Computer networks, such as those available at a workplace, university, or other organization, are often configured to provide remote access to users through virtual private networks (VPNs), customized network settings, and/or other technologies. Users must typically authenticate to remote networks before being granted access. Authentication may involve users providing various authentication factors, such as user IDs, passwords, token codes, and personal identification numbers (PINs). In a typical scenario, a user submits an authentication request containing one or more authentication factors to an authentication server. The authentication server receives the request and either grants or denies network access to the user based on whether the submitted authentication factors match expected values.
A common authentication scheme involves the use of token codes. Token codes, also known as one-time passwords, or “OTPs,” are generated automatically, such as by portable devices (i.e., “hard tokens”), which may be distributed to users. An example of a hard token is the SecureID® token code generator, which is available from RSA Security Inc., of Bedford, Mass. Recently, software has been developed to perform the functions of hard tokens on smart mobile devices, such as smart phones, PDAs, and tablets. Like hard tokens, these “soft tokens” generate token codes at regular intervals. Token codes generated by a soft token are displayed on a display screen of a user's smart mobile device. A token code is entered manually by the user into a login screen presented on the user's computer, which then forwards the token code, along with any additional authentication information, to the authentication server, which either grants or denies access to the user.
To enhance security, various adaptive authentication schemes have been developed. These adaptive authentication schemes collect machine-specific and user-specific information from a user's computer and provide the information to the authentication server along with other authentication factors (e.g., token codes). The authentication server then applies the information it receives about the user's computer in granting or denying access to the user. For example, prior authentication servers have employed risk engines to assess levels of risk associated with granting remote network access to certain users or their computers. The risk engines are heuristically based, collecting a wide range of information about the user's computer or about the user, based on information received from the user's computer. Gathered data are rendered as risk factors, which are weighted and combined to generate a risk score. The risk score is then tested against a predetermined threshold. If the risk score falls below the threshold, authentication of the user may proceed. If the risk score exceeds the threshold, authentication of the user may be denied.